github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6145] End-of-options not honored when running under existing sandbox. #3199

New issue

Open

opened 2026-05-05 09:49:02 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 09:49:02 -06:00

Owner

Originally created by @rusty-snake on GitHub (Dec 30, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6145

Description

The end-of-options operator is not honored when running under existing sandbox.

Steps to Reproduce

Run firejail --quiet -- anything_here_should_not_change_firejails_behaviour under conditions that are detected as "existing sandbox".

$ firejail --quiet --noprofile env -u FIREJAIL_QUIET firejail --quiet -- echo "Hello firejail"
Hello firejail
$ firejail --quiet --noprofile env -u FIREJAIL_QUIET firejail --quiet -- --debug echo "Hello firejail"
Building quoted command line: 'echo' 'Hello firejail' 
Starting application
LD_PRELOAD=(null)
Detected Landlock ABI version 3
execvp argument 0: echo
execvp argument 1: Hello firejail
Searching $PATH for echo
trying #/usr/local/bin/echo#
trying #/usr/local/sbin/echo#
trying #/usr/bin/echo#
Hello firejail

Expected behavior

--debug is not interpreted by firejail.
Using -- causes program to be started in a shell.

Actual behavior

--debug is interpreted by firejail.
Using -- does not cause program to be started in a shell.

Behavior without a profile

N/A

Additional context

N/A

Environment

Fedora 39
Firejail 0.9.73
n/a

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

n/a

Output of LC_ALL=C firejail --debug /path/to/program

n/a

Originally created by @rusty-snake on GitHub (Dec 30, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/6145 ### Description The end-of-options operator is not honored when running under existing sandbox. ### Steps to Reproduce Run `firejail --quiet -- anything_here_should_not_change_firejails_behaviour` under conditions that are detected as "existing sandbox". ```console $ firejail --quiet --noprofile env -u FIREJAIL_QUIET firejail --quiet -- echo "Hello firejail" Hello firejail $ firejail --quiet --noprofile env -u FIREJAIL_QUIET firejail --quiet -- --debug echo "Hello firejail" Building quoted command line: 'echo' 'Hello firejail' Starting application LD_PRELOAD=(null) Detected Landlock ABI version 3 execvp argument 0: echo execvp argument 1: Hello firejail Searching $PATH for echo trying #/usr/local/bin/echo# trying #/usr/local/sbin/echo# trying #/usr/bin/echo# Hello firejail ``` ### Expected behavior 1. `--debug` is not interpreted by firejail. 2. Using `--` causes program to be started in a shell. ### Actual behavior 1. `--debug` is interpreted by firejail. 2. Using `--` does not cause program to be started in a shell. ### Behavior without a profile N/A ### Additional context N/A ### Environment - Fedora 39 - Firejail 0.9.73 - n/a ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` n/a ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` n/a ``` </p> </details>

gitea-mirror added the

bug

label 2026-05-05 09:49:02 -06:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3199

No description provided.

Rows
Columns